All Detections

CWP loopback API root command injection via grep/passwd shell-out

avatar
ills3c Intel&Coffee@Ills3C
updated 7 days ago104

Detects root shell-outs containing shell metacharacters from the Control Web Panel (CWP) loopback user API (127.0.0.1:2302) affecting endpoints like valid_token and newpass.

Microsoft Sentinel (KQL)